The Journal of Business, Entrepreneurship & the Law

Volume 13 Issue 2 Article 6

5-15-2020

Ethical Implications of in Criminal Cases

Solana Lund

Follow this and additional works at: https://digitalcommons.pepperdine.edu/jbel

Part of the Criminal Law Commons, Legal Ethics and Professional Responsibility Commons, Privacy Law Commons, and the Science and Technology Law Commons

Recommended Citation Solana Lund, Ethical Implications of Forensic Genealogy in Criminal Cases, 13 J. Bus. Entrepreneurship & L. 185 (2020) Available at: https://digitalcommons.pepperdine.edu/jbel/vol13/iss2/6

This Comment is brought to you for free and open access by the Caruso School of Law at Pepperdine Digital Commons. It has been accepted for inclusion in The Journal of Business, Entrepreneurship & the Law by an authorized editor of Pepperdine Digital Commons. For more information, please contact [email protected], [email protected], [email protected].

ETHICAL IMPLICATIONS OF FORENSIC GENEALOGY IN CRIMINAL CASES

Solana Lund*

I. FORENSIC GENEALOGY ...... 186 II. DIRECT TO CONSUMER DATABASES ...... 189 A. Terms and Conditions ...... 189 B. Regulations ...... 192 C. GEDmatch...... 193 III. A SUMMARY OF CRIMINAL CASES THAT HAVE USED DTC AND FORENSIC GENEALOGY ...... 195 IV. ETHICAL IMPLICATIONS AND CONCERNS ...... 196 A. Informed Consent ...... 197 B. Legal Issues ...... 198 C. Privacy Concerns ...... 200 V. MOVING FORWARD ...... 201 A. Informed Consumer Consent and Company Transparency ...... 202 B. DNA Privacy Laws ...... 203 C. Case Selection Criteria ...... 206 CONCLUSION ...... 207

Growing up, I heard stories about my great grandpa James Stanton, the son of Irish immigrants who was orphaned at a young age. James grew up in New York in the early 1900s and eventually made his way to Utah, where he met and married my great grandma. James rarely spoke about his parents, and for the longest time the only thing he told us is that they were Irish. When he died in 1968, that was essentially all we knew about them. My mother tried repeatedly to find James’ parents and complete our family tree but continuously ran into dead ends. It was a family history “” for most of my life. Then, last year, my mother caught a break in the case and discovered that my Irish orphan great grandpa James Stanton was actually my Polish runaway great grandpa Joseph Balkum. While the revelation that James Stanton was actually Joseph Balkum sent shockwaves through my family, it did not garner national attention like the apprehension of the Golden State Killer. The Golden State Killer terrorized central and southern in the 1970s and 80s 186 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II on a seemingly unstoppable criminal rampage.1 He is thought to be responsible for committing sixty home invasions, fifty , and thirteen , making him one of America’s most prolific serial killers.2 While his crime spree ended in the 80s, the police never captured the Golden State Killer.3 The case remained unsolved until last year when police arrested Joseph James DeAngelo Jr. and charged him as the Golden State Killer.4 While it could be a few years before the trial even starts, prosecutors are confident that they have their man and say that they will seek the death penalty.5 While both mysteries were solved last year, on the surface they have very little in common. What does the discovery of a long-lost grandpa and the revelation of the identity of notorious have in common? Both cold cases were solved using forensic genealogy.

I. FORENSIC GENEALOGY

Forensic Genealogy is the process of using DNA matches to reverse engineer a family tree.6 A DNA sample is submitted to a DNA database (e.g., 23andMe or Ancestry.com), resulting in various matches. Using those matches, “[f]amily trees are developed for individuals as close or closer than third or fourth cousins, with an eye to where disparate branches of the family trees cross, indicating a family where both paternal and maternal lines combine in a single family.”7 While the DNA match is

* J.D. Pepperdine University School of Law 2020 1 Paige St. John, et. al, Mapping the Golden State Killer, L.A. TIMES (June 11, 2019), https://www.latimes.com/projects/man-in-the-window-crime- map-golden-state-killer-serial/. 2 Id. 3 Breeana Hare & Christo Taoushiani, What we know about the Golden State Killer case, one year after a suspect was arrested, CNN, https://www.cnn.com/2019/04/24/us/golden-state-killer-one-year- later/index.html (last updated Apr. 24, 2019). 4 St. John, supra 1. 5 Id. 6 Colleen Fitzpatrick & Dee Dee King, Forensic Genealogy—Dead Men Do Tell Tales, RECORD CLICK PROFESSIONAL GENEALOGISTS, https://www.recordclick.com/forensic-genealogy-dead-men-do-tell-tales/ (last visited Mar. 9, 2020). 7 RAY A. WICKENHEISER, Forensic Genealogy, Bioethics and the Golden State Killer Case, 1 FORENSIC SCIENCE INTERNATIONAL: SYNERGY 114,

2020 ETHICAL IMPLICATIONS 187 the first step in forensic genealogy, there is more investigation that goes into it. After a match is found, investigators will use a variety of resources to complete the family tree. Common resources include “census records, vital records, newspaper archives, public ‘people search’ databases, public social media data, and public family trees.”8 If there are two potential DNA matches for a single sample, descendancy research is performed to trace the descendants of each set of ancestors to determine if an intersection between them can be found.9 When my mother uploaded her DNA to Ancestry, her DNA matched with a second cousin, a woman she never heard of before. My mother reached out to her and through her own forensic genealogy discovered the truth about Joseph Balkum, alias James Stanton. Joseph Balkum ran away from home when he was fifteen after a fight with his mother. He changed his name and took this secret to his grave. Without DNA testing, my family would likely have never learned the truth about our heritage. Similarly, the Golden State Killer’s DNA was uploaded to GEDmatch—a public DNA database—resulting in a match to a potential a distant relative.10 Investigators then used traditional genealogical research methods to reverse engineer a family tree, leading them to Joseph DeAngelo.11 Once they suspected DeAngelo, police obtained a sample of his DNA from his discarded trash and compared it to suspect DNA left at one of the Golden State Killer’s crime scenes, resulting in a match.12 After decades of searching, forensic genealogy provided a break in the Golden State Killer case.

118 (July 12, 2019), https://www.sciencedirect.com/science/article/pii/S2589871X19301342. 8 ELLEN M. GREYTAK, et al., for Cold Cases and Active Investigations, 299 FORENSIC SCIENCE INTERNATIONAL 103, 106 (Mar. 27, 2019), https://www.sciencedirect.com/science/article/pii/S0379073819301264. 9 Id. 10 Jocelyn Kaiser, New federal rules limit police searches of family tree DNA databases, SCI. MAG. (Sept. 25, 2019), https://www.sciencemag.org/news/2019/09/new-federal-rules-limit-police- searches-family-tree-dna-databases. 11 Id. 12 Breeanna Hare & Christo Taoushiani, What we know about the Golden State Killer Case, one year after a suspect was arrested, CNN (Apr. 24, 2019), https://www.cnn.com/2019/04/24/us/golden-state-killer-one-year- later/index.html. 188 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II

While the use of DNA in criminal cases is nothing new, the increase in access to DNA analyses through Direct to Consumer genetic testing providers is changing the game. One study suggested that it is often possible to identify an unknown individual from a single third-cousin- level match given knowledge of his or her sex, location within 100 miles, and age within five years.13 Another report claims that “[i]f you’re white, live in the United States, and a distant relative has uploaded their DNA to a public ancestry database, there’s a good chance an internet sleuth can identify you from a DNA sample you left somewhere.”14 A search like that could potentially identify about 60% of white Americans from a DNA sample.15 Yaniv Elrich, a computational geneticist at Columbia University says that, “in a few years, it’s really going to be everyone” that can be identified.16 Forensic genealogy is still a fairly new and rare application gaining notoriety as its use in major crime cases increases. There has been a noticeable increase in the use of forensic genealogy as the popularity of direct-to-consumer genetic testing providers increased.17 While the technology that enabled forensic genealogy is impressive and no one is opposed to catching serial killers, there are still ethical concerns about the use of DNA and forensic genealogy.18 As Sacramento County District Attorney Ann Marie Schubert put it, “[i]t is probably one of the greatest revolutions, at least I would say, in my lifetime as a prosecutor . . . [b]ut it is a difficult, evolving topic because there are privacy interests at stake in an area that’s unregulated.”19

13 GREYTAK, supra note 8, at 108. 14 JOCELYN KAISER, We will find you: DNA search used to nab Golden State Killer can home in on about 60% of white Americans, SCI. MAG. (Oct. 11, 2018), https://www.sciencemag.org/news/2018/10/we-will-find-you-dna-search- used-nab-golden-state-killer-can-home-about-60-white. 15 Id. 16 Id. (quoting Yaniv Elrich). 17 Paige St. John, DNA genealogical databases are a gold mine for police, but with few rules and little transparency, L.A. TIMES (Nov. 24, 2019), https://www.latimes.com/california/story/2019-11-24/law-enforcement-dna- crime-cases-privacy. 18 Benjamin Berkman, The Questionable Ethics of Expanding Forensic DNA Testing, PAC. STANDARD (Mar. 21, 2019), http://www.psmag.com/ social- justice/the-ethical-questions-about-expanded-dna-testing. 19 St. John, supra 17 (quoting Ann Marie Schubert).

2020 ETHICAL IMPLICATIONS 189

II. DIRECT TO CONSUMER DATABASES

The U.S. National Library of Medicine defines Direct to Consumer (DTC) genetic testing as genetic tests that are marketed directly to customers.20 Customers send the company a DNA sample and receive their results directly from a secure website or in a written report, without involving a healthcare provider or health insurance company.21 Consumers can get information on diseases and health conditions to which they may be genetically predisposed, as well as information about their ancestry. These DTC genetic tests increased in popularity in the past few years, with the tests costing as little as $59.22 The two leading DTC providers are Ancestry of Lehi, Utah and 23andMe of Mountain View, California.23 Two other popular DTC providers are FamilyTreeDNA (FTDNA) and MyHeritage.24

A. Terms and Conditions

With approximately 15 million DNA samples, Ancestry is the largest DTC provider.25 To use Ancestry, a consumer must be at least 18 years old, although a parent with full legal custody may send in his or her child’s sample.26 A consumer submits a vial of saliva for a DNA test,25 making it nearly impossible for someone to submit a third party’s DNA sample. Additionally, Ancestry requires “explicit consent” from the person providing the saliva sample.27 Ancestry maintains a “you own your own data” approach to its services, which is one of the first things listed in its terms and conditions.28

20 U.S. Nat'l Libr. of Med., What is direct-to-consumer genetic testing?, GENETIC HOME REFERENCE (Nov. 26, 2019), https://ghr.nlm.nih.gov/primer/dtcgenetictesting/directtoconsumer. 21 Id. 22 Antonio Regalado, More than 26 million people have taken an at- home ancestry test, MIT TECH. REV. (Feb. 11, 2019), https://www.technologyreview.com/s/612880/more-than-26-million-people- have-taken-an-at-home-ancestry-test/. 23 Id. 24 Greytak, supra note 8, at 106. 25 Id. 26 Ancestry Terms and Conditions, ANCESTRY (July 25, 2019), https://www.ancestry.com/cs/legal/termsandconditions. 25 Id. 27 Id. 28 Id. 190 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II

Consumers grant the company the license to their data so Ancestry can provide products and services.29 At any time, consumers can request that their data be deleted, and Ancestry will comply.30 Ancestry will not share genetic data with employers, insurance providers, or third-party marketers without first obtaining consent.31 Ancestry’s privacy statement makes it clear that it will not voluntarily cooperate with law enforcement.32 If Ancestry is compelled to disclose a consumer’s personal information to law enforcement, it will do its best to provide the consumer with advanced notice, unless prohibited by law.33 In the interest of transparency, Ancestry also produces an annual transparency report where it lists the number of valid law enforcement requests it received for user data across its sites.34 In 2008, Ancestry received ten valid law enforcement requests for user information and provided information in response to seven of those requests; all of these requests related to investigations of credit card misuse, fraud, and identity theft.35 Ancestry received no valid requests for genetic information of any Ancestry member and stated that it does not disclose such information to law enforcement.36 23andMe has approximately ten million consumers.37 Like Ancestry, a consumer can only submit his or her own saliva sample or a sample for someone for which he or she has legal authority.38 23andMe has a guide for law enforcement on its site, in which it makes clear that “23andMe chooses to use all practical legal and administrative resources to resist requests from law enforcement, and we do not share customer data with any public databases, or with entities that may increase the risk of law

29 Eric Heath, Setting the Record Straight: Ancestry and Your DNA, ANCESTRY (May 21, 2017), https://blogs.ancestry.com/ancestry/2017/05/21/setting-the-record-straight- ancestry-and-your-dna/. 30 Id. 31 Id. 32 Your Privacy, ANCESTRY (July 25, 2019), https://www.ancestry.com/cs/legal/privacystatement. 33 Id. 34 Id. 35 Ancestry 2018 Transparency Report, ANCESTRY, (last updated Mar. 3, 2020), https://www.ancestry.com/cs/transparency. 36 Id. 37 Greytak, supra note 8, at 106. 38 Terms of Service, 23ANDME (Sept. 30, 2019), https://www.23andme.com/about/tos/.

2020 ETHICAL IMPLICATIONS 191 enforcement access.”39 However, it does add that, in certain circumstances, it may be required to comply with a valid court order, subpoena, or search warrant for genetic or personal information.40 23andMe also periodically publishes a transparency report, which was last updated on October 15, 2019.41 As of this most recent update, 23andMe received seven government requests for data from ten specified users and produced zero data as a result of the requests.42 FamilyTreeDNA has over a million DNA profiles on its site.43 Every DNA test kit consists of two cotton swabs designed to be used by one individual.44 When a consumer sends in the cheek swabs, he or she must also send in a signed consent form.45 While FTDNA does not extract from forensic samples (like hair, toothbrushes, tissues, etc.), it will accept blood cards for extraction.46 Even though FTDNA advertises the fact that it cooperates with law enforcement, it still requires law enforcement officers to request to submit a sample or genetic file to the database.47 Permission is only granted to identify the remains of a deceased individual or to identify a perpetrator of a homicide, sexual assault, or abduction.48 While FTDNA does not currently have a transparency report, it is working towards publishing a transparency report “that contains details on all law enforcement requests for user information that we receive” as well as “the number of forensic samples and files we have received.”49 Unlike the other three large DTC providers, MyHeritage operates in Europe.50 As of September 2018, MyHeritage DNA database had

39 23andMe Guide for Law Enforcement, 23ANDME, https://www.23andme.com/law-enforcement-guide/ (last updated Mar. 3, 2020). 40 Id. 41 Transparency Report, 23ANDME, https://www.23andme.com/transparency-report/ (last updated Mar. 3, 2020). 42 Id. 43 Salvador Hernandez, One of the Biggest At-Home DNA Testing Companies is Working With the FBI (Jan. 31, 2019), https://www.buzzfeednews.com/article/salvadorhernandez/family-tree-dna-fbi- investigative-genealogy-privacy. 44 DNA Test Kit Instructions, FAMILYTREEDNA, https://learn.familytreedna.com/testing-process/dna-test-kit-instructions/. 45 Id. 46 FamilyTreeDNA Learning Center, FAMILYTREEDNA, https://learn.familytreedna.com/ftdna/forensic-samples/. 47 FamilyTreeDNA Law Enforcement Guide, FAMILYTREEDNA, https://www.familytreedna.com/legal/law-enforcement-guide. 48 Id. 49 Id. 50 REGALADO, supra note 22. 192 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II approximately 1.75 million DNA users.51 For its DNA test, MyHeritage requires “a simple cheek swab (no blood or spit).”52 MyHeritage states that by submitting a sample, the consumer represents that the DNA sample is his or her own, or that of a person for whom the consumer is a legal guardian, or of a person for whom the consumer has obtained legal authorization to provide his or her DNA to MyHeritage.53 Additionally, its terms and conditions state that “using DNA Services for law enforcement purposes, forensic examinations, criminal investigations, ‘cold case’ investigations, identification of unknown deceased people, location of relatives of deceased people using cadaver DNA, and/or all similar purposes, is strictly prohibited, unless a court order is obtained.”54 MyHeritage does not currently publish a transparency report.55

B. Regulations

The DTC market has been described as the “wild west” due to the current lack of regulations.56 For a brief period in 2010, it appeared that the U.S. Food and Drug Administration (FDA) intended to regulate the DTC market when it notified a company that its genetic test kit “appeared to meet the definition of a medical device” under the Food, Drug, and Cosmetic Act, giving the FDA jurisdiction to regulate the kit.57 However, the FDA used its “enforcement discretion” and elected not to regulate the DTC genetic testing market used for ancestry purposes.58 Additionally, the

51 MyHeritage Has More Than 1.75 Million DNA Users!, THEDNAGEEK (Sept. 16, 2018) https://thednageek.com/myheritage-has-more- than-1-75-million-dna-users/. 52 How Does DNA Testing Work?, MYHERITAGE, https://www.myheritage.com/dna. 53 My Heritage – Terms and Conditions, MYHERITAGE, (last viewed Dec. 1, 2019) https://www.myheritage.com/terms-and-conditions. 54 Id. 55 Id. (Showing that there is an omission of transparency report). 56 Elizabeth E. Joh, DNA Theft: Recognizing the Crime of Nonconsensual Genetic Collection and Testing, 91 B.U. L. REV. 665, 675 (2011). 57 FORENSIC DNA EVIDENCE: SCIENCE AND THE LAW § 13:15. 58 See Joh, supra note 56; Direct-To-Consumer Tests, FDA, https://www.fda.gov/medical-devices/vitro-diagnostics/direct-consumer-tests.

2020 ETHICAL IMPLICATIONS 193

Federal Trade Commission does not provide any regulation or oversight of laboratories that provide DTC genetic testing for ancestry purposes. 59 The federal agency that is most directly responsible for regulating DTC tests is the Center for Medicare and Medicaid Services (CMS). The CMS enforces the Clinical Laboratory Improvement Amendments of 1988, a law that applies to all clinical laboratories providing testing services.60 However, CMS’s regulatory authority only addresses analytical validity, but not clinical validity.61 Analytical validity measures whether a lab performing a test reliably identifies the absence or presence of a certain genetic variation, whereas clinical validity refers to whether the genetic variant correlates with a specific disease or condition.62 While the discrepancy between analytical and clinical validity has no significant bearing on forensic genealogy, it does illustrate the lack of oversite into these DTC laboratories. While the FDA does not provide any serious regulation of DTC tests, it does provide information on the tests on its website.63 The FDA also makes it clear that no test is 100% accurate. While the FDA does not regulate ancestry tests, it granted market clearance to 23andMe for its various health screening options that it offers.64

C. GEDmatch

GEDmatch does not technically qualify as a DTC provider because consumers do not send their DNA samples directly into GEDmatch, but it still plays an active role in forensic genealogy. GEDmatch is a public platform where consumers can upload their DNA results that they obtained from other DTC providers to compare their results with other people.65 GEDmatch was crucial in the apprehension of the Golden State Killer. After the Golden State Killer suspect was identified through the use of GEDmatch, the site’s administration decided

59 See Joh, supra note 56 60 Id. 61 Id. 62 Id. 63 Direct-To-Consumer Tests, FDA, https://www.fda.gov/medical- devices/vitro-diagnostics/direct-consumer-tests. 64 Id. 65 Tools for DNA and Genealogy Research, GEDMATCH, https://www.gedmatch.com/login1.php. 194 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II to explicitly allow law enforcement to use the site.66 In April of 2018, GEDmatch informed its users of the following:

While the database was created for genealogical research, it is important that GEDmatch participants understand the possible use of their DNA, including identification of relatives that have committed crimes or were victims of crimes. If you are concerned about non-genealogical uses of your DNA, you should not upload your DNA to the database and/or you should remove DNA that has already been uploaded.67

Following the arrest of the Golden State Killer and the announcement of its decision to fully cooperate with law enforcement, GEDmatch saw a significant increase in the number of participants on the site.68 Listed in bright red in its Terms of Service and Privacy Policy, consumers are informed that their DNA may be compared to “DNA obtained and authorized by law enforcement to identify a perpetrator of a violent crime against another individual, where ‘violent crime’ is defined as , nonnegligent manslaughter, aggravated , robbery, or aggravated assault; [Or] DNA obtained and authorized by law enforcement to identify remains of a deceased individual.”69 In addition to fully cooperating with law enforcement, GEDmatch partnered with Parabon, a company that is constantly comparing the DNA uploaded to GEDmatch to DNA provided by law enforcement officers trying to catch a break in their case.70 Parabon monitors all unsolved cases for new matches on a weekly basis.71

66 Greytak, supra note 8, at 106. 67 Id. 68 Id. at 107. 69 Terms of Service and Privacy Policy, GEDMATCH (May 18, 2019), https://www.gedmatch.com/tos.htm. 70 Greytak, supra note 8, at 107. 71 Id.

2020 ETHICAL IMPLICATIONS 195

III. A SUMMARY OF CRIMINAL CASES THAT HAVE USED

DTC AND FORENSIC GENEALOGY

While the Golden State Killer case garnered the most media attention, it is not the only case in recent years in which law enforcement officials used forensic genealogy and DTC databases in their investigations. Since that case, more than thirty rapists, killers, and victim’s bodies have been identified in the same way.72 Some sources reported up to sixty-six DNA-derived cases.73 These cases include the identification of the man who murdered eight-year-old April Tinsley in 1988, and the “NorCal Rapist” who was active from 1991 through 2006.74 The first conviction resulting from a case using forensic genealogy was in June of 2018 when Washington native William Earl Talbott was found guilty for the 1987 murder of a British Columbia couple.75 For over three decades, detectives investigated hundreds of leads but were unable to crack the case. In 2017, a Snohomish County Sheriff’s detective learned about Parabon Labs and the possibility of building a family tree that leads to a suspect.76 The suspect’s DNA from the crime scenes resulted in a match on GEDmatch with two unrelated second cousins.77 When family trees were developed based on these matches, Talbott was the only male carrier for the mix of DNA from the two families.78 DNA on a discarded paper cup from Talbott’s truck matched the DNA from the crime scene, leading to Talbott’s arrest.79 The arrest and subsequent conviction provided peace for the victims’ families, who say, “It feels great to have some of the answers. We don’t have all the answers, but we have a lot more than we had for 31 years.”80 While many of the headlines surrounding forensic genealogy are about its effectiveness in catching killers, it has also been a source of exoneration. In July of 2019, an Idaho judge dismissed all charges against

72 Regalado, supra note Error! Bookmark not defined.. 73 St. John, supra note 17. 74 Greytak, supra note 8, at 104. 75 SeaTac Man Convicted of 1987 Murders of Canadian Couple After DNA Evidence Linked Him to Case, SEATTLE TIMES (June 28, 2019, 3:58 PM), https://www.seattletimes.com/seattle-news/crime/seatac-man-convicted-of- 1987-murders-of-canadian-couple-after-dna-evidence-linked-him-to-case/. 76 Id. 77 Id. 78 Id. 79 Id. 80 Id. 196 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II

Christopher Tapp, a man wrongfully convicted in 1996 of the rape and murder of an 18-year-old.81 There had long been evidence that Tapp’s confession to the crimes was coerced, but when forensic genealogy confirmed that he was not the perpetrator, his name was cleared.82 Interestingly enough, it was the persistence of the victim’s mother that was most instrumental. She insisted that a genetic genealogist analyze the DNA evidence in the case, finding a link to another man who confessed to the decades-old killing.83 While it is disheartening that Tapp was convicted after a coerced confession, this case does demonstrate that forensic genealogy has the potential to exonerate as well as convict.

IV. ETHICAL IMPLICATIONS AND CONCERNS

There are mixed reactions to the use of forensic genealogy in criminal cases, both in the public at large and in the genealogical community. Prominent genealogists had bitter disagreements over whether or not police should be able to use genealogical databases that resulted in groups on Facebook banning the discussion.84 At a genealogical conference in June of 2019, the different sides of the debate ignored each other from opposite ends of the bar, refusing to speak to or acknowledge one another.85 It is a complicated issue because catching murders and solving cold cases is something that is widely supported for obvious reasons. It can provide closure for families, as well as bring criminals to justice. However, there are opposing and competing interests: that of individual privacy and that of public safety. As one scholar puts it, “[T]o what extent can the rights of the innocent general public and relatives of the committer of a crime be infringed upon by interrogating their genetic data to identify the crime perpetrator and thereby prevent future crimes

81 Mia Armstrong, In an Apparent First, Genetic Genealogy Aids a Wrongful Conviction Case, THE MARSHALL PROJECT (July 17, 2019, 4:45 PM), https://www.themarshallproject.org/2019/07/16/in-an-apparent-first-genetic- genealogy-aids-a-wrongful-conviction-case. 82 Id. 83 Id. 84 Sarah Zhang, The Messy Consequences of the Golden State Killer Case, (Oct. 1, 2019), https://www.theatlantic.com/science/archive/2019/10/genetic-genealogy-dna- database-criminal-investigations/599005/. 85 Id.

2020 ETHICAL IMPLICATIONS 197 and improve public safety?”86 Some of the biggest ethical concerns about forensic genealogy revolve around informed consent, the legal implications of the technology, and privacy concerns.

A. Informed Consent

Consumers often do not think of the potential implications and repercussions of submitting their DNA to a DTC provider, especially when they are doing so predominantly for ancestry purposes. For most people, this process is done for entertainment or sentimental reasons. As Benjamin Berkman, the head of ethics of genetics and new technologies at the National Institutes of Health’s Department of Bioethics, puts it, “Genealogy is typically done for entertainment purposes. . . . People may not realize uploading their DNA could be responsible for a cousin’s arrest as well.”87 While a consumer may readily check the “I have read the terms and conditions” box, that does not guarantee that they actually read the terms and conditions. Even if they did, they may not have understood to what they were consenting. “The terms of service agreements don’t explain clearly, and even if they did, people wouldn’t read it or find it in the dense legalese.”88 There was recently a woman in Washington state who learned after the fact that her DNA on GEDmatch led to the arrest of her second cousin twice removed, a man who she never met and did not know, for murder in Iowa.89 While she was initially unsure about how she felt, she now says, “I feel OK about it . . . I want someone to have to do time if [he/she] did something like that. I don’t regret it now.”90 There are also issues regarding whether or not DNA donors to DTC providers actually consented to the analysis of their DNA. While most DTC providers claim that the DNA submitted to them must be done so with the DNA donors’ consent, including the four DTC providers discussed above, there is little done to actually regulate this. Currently,

86 WICKENHEISER, supra note 7, at 119. 87 Carolyn Crist, Experts Outline Ethics Issues with Use of Genealogy DNA to Solve Crimes, (June 1, 2018), https://www.reuters.com/article/us-health-ethics-genealogy-dna/experts-outline- ethics-issues-with-use-of-genealogy-dna-to-solve-crimes-idUSKCN1IX5O6. 88 Id. 89 Sarah Zhang, A DNA Company Wants You to Help Catch Criminals, THE ATLANTIC (March 29, 2019), https://www.theatlantic.com/science/archive/2019/03/a-dna-company-wants- your-dna-to-catch-criminals/586120/. 90 Id. 198 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II

DTC providers have no real incentive to check that the samples mailed to them legitimately belong to the consumer.91 A journalist at New Scientist found that “genome hacking” was relatively easy to conduct after he “collect[ed] his colleague’s saliva from a cup (with his consent).”92 He had “one company extract the DNA, [had] another amplify the sample to create enough DNA for analysis, and [had] yet another analyze the DNA for any medical predispositions.”93 The journalist “also successfully submitted a cheek swab with his colleague's DNA for analysis.”94 While none of the companies the journalist used to analyze his coworkers DNA were any of the above discussed DTC providers, they were all companies that claimed in their terms and conditions that customers submitting DNA for analysis had to have the legal authority to do so.95 However, none of them checked the journalist’s claim that the DNA submitted was his.96 If a consumer can get the required DNA samples for Ancestry, 23andMe, MyHeritage, or FTDNA, nothing is preventing him or her from submitting someone else’s DNA for analysis. It would be as easy as checking the right box or forging a signature to have someone else’s DNA analyzed through one of these providers.

B. Legal Issues

It is a well-established aspect of criminal law that law enforcement officers can use any technology in their investigations that is readily available to the public,97 so there is nothing specifically barring the use of forensic genealogy in criminal cases. However, in response to the outcry of concern since the Golden State Killer case, the United States Department of Justice (DOJ) released an interim policy on forensic genetic genealogical DNA analysis and searching.98 The policy was approved on

91 Joh, supra note 56, at 677–78. 92 Id. at 678. 93 Id. 94 Id. 95 Id. 96 Id. 97 Kyllo v. United States, 533 U.S. 27, 34 (2001) (holding that the technology in question was not in general public use, and it was therefore unconstitutional for the police to use it during their investigation). 98 U.S. DEP’T OF JUSTICE, INTERIM POLICY: FORENSIC GENETIC GENEALOGICAL DNA ANALYSIS AND SEARCHING (2019), https://www.justice.gov/olp/page/file/1204386/download.

2020 ETHICAL IMPLICATIONS 199

September 2, 2019, and went into effect on November 1, 2019.99 The Department of Justice stated that they are “committed to developing practices that protect reasonable interests in privacy, while allowing law enforcement to make effective use of FGGS [(forensic genetic genealogical DNA analysis and searching)] to help identify violent criminals, exonerate innocent suspects, and ensure the fair and impartial administration of justice to all Americans.”100 They also clarify that any personal genetic information that is used in this process is not transferred, retrieved, downloaded, or retained during the automated search and comparison process.101 None of the information or data derived from FGGS is uploaded or retained in the CODIS DNA Index, the government’s own DNA database.102 The policy clarifies that any information derived from genetic associations are only used as an investigative lead, and no suspect can be arrested based solely on a genetic association.103 Once a suspect is identified, the suspect’s DNA must be compared directly to the DNA sample from the original crime to confirm that the forensic sample could have originated from the suspect.104 Case criteria are also set forth in the interim policy. Forensic genealogy may be used by investigative agencies when a case involves an unsolved violent crime (here defined as any homicide or sex crime) and the forensic sample is from the perpetrator, or if the case involves the unidentified remains of a suspected homicide victim.105 Additionally, prosecutors may authorize the use of forensic genealogy when there is a substantial and ongoing threat to public safety or national security.106 Investigative agencies are now required to identify themselves as law enforcement when they are working with DTC genealogy services and can only work with DTC services that provide “explicit notice” to their users and the public that law enforcement may use their services.107 The Department of Justice’s interim policy is a concrete step towards regulating forensic genealogy in criminal cases, but it only applies in four specific instances. The policy applies to (1) criminal investigations in which the Department of Justice has exclusive or concurrent jurisdiction

99 Id. 100 Id. 101 Id. at 3. 102 Id. at 4. 103 Id. 104 Id. 105 Id. 106 Id. 107 Id. 200 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II of the crime and lawful custody of the forensic samples; (2) any criminal investigation in which the DOJ provides funding to a federal, state, local, or tribal agency; (3) any criminal investigation in which DOJ employees or contractors conduct the genealogical research on leads generated through forensic genealogy; and (4) any federal agency or any unit of state, local, or tribal government that receives grants from the Department for the purpose of forensic genealogy.108 While these categories will naturally encompass many of the law enforcement officers and agencies that want to use forensic genealogy, there are still state and local law enforcement agencies that are exempt from these regulations. An interesting legal point to note is that if a suspect took issue with forensic genealogy database searching, that suspect would have no legal standing to bring a claim against the government because the only person who could bring a suit is the relative whose DNA is used.109 This could potentially be relevant in cases like that of an innocent twin thrown in jail in California for suspected rape.110

C. Privacy Concerns

Another concern surrounding forensic genealogy is about expectations of privacy and issues of abandoned property. Because people leave discarded DNA in a variety of forms, whether it is skin cells, hair follicles, saliva on cups, or other ways, it is comparable to discarded or abandoned property. In this way, it can be considered legally analogous to trash. The Supreme Court addressed this issue in California v. Greenwood, wherein it held that its “decisions concerning the scope of the Fourth Amendment exclusionary rule have balanced the benefits of deterring police misconduct against the costs of excluding reliable evidence of criminal activity.”111 This case was a result of law enforcement requesting that trash collectors retrieve a suspect’s garbage.112 After officers searched his garbage, they found evidence of narcotics use and arrested him.113 In its opinion, the Court also made it clear that for individuals to be protected by the Fourth Amendment, not only must they

108 Id. 109 Wickenheiser, supra note 7, at 120. 110 Paige St. John, supra note 17. 111 California v. Greenwood, 486 U.S. 35, 44 (1988). 112 Id. at 38. 113 Id.

2020 ETHICAL IMPLICATIONS 201 have a legitimate expectation of privacy, but also society must “accept that expectation as objectively reasonable.”114 While the analysis in Greenwood may have seemed thorough and appropriate in 1988, the ability to analyze discarded DNA is beyond what many people could have imagined thirty years ago. Now people’s discarded trash can provide more than just details about how they live—it has the potential to provide incredibly personal and detailed genetic information. The Court in Greenwood makes it clear that states can legislate the issue further, and in May of 2019, Oregon did just that. In State v. Lien, the Supreme Court of Oregon ruled that the defendants had a constitutionally protected privacy interest in their garbage, even after the sanitation company manager retrieved it from a curbside bin and turned it over to the police.115 There are no facts that strongly differentiate Lien from Greenwood, other than the fact that Oregon decided to further legislate the issue of privacy rights in discarded material, like trash or genetic material. While this has the potential to extend protection and privacy rights to discarded genetic material, Oregon never explicitly discussed DNA, genetic privacy, or the potential implications of its ruling. There are also legitimate privacy concerns that, despite what they claim, there is nothing to keep DTCs from secretly cooperating with the police. As revealed by BuzzFeed in January of 2019, FamilyTreeDNA secretly worked with the FBI and allowed agents to search its vast database.116 This marked the first time a private firm agreed to voluntarily allow law enforcement access to its database.117 Despite FTDNA’s secret cooperation with the FBI, there has been virtually no repercussion, and FTDNA is now using cooperation with law enforcement as a marketing strategy.118

V. MOVING FORWARD

Because using DTC DNA databases for forensic genealogy in criminal cases is fairly new, there are not many set guidelines regulating their use. While there have not been any serious negative side effects as of yet, it would be wise to take preventative measures to ensure that this technology is not abused.

114 Id. at 40. 115 441 P.3d 185, 202 (Or. 2019). 116 Hernandez, supra note 43. 117 Id. 118 Zhang, supra note 89. 202 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II

A. Informed Consumer Consent and Company Transparency

An important step towards resolving the ethical issues surrounding forensic genealogy is to encourage consumers to know in what they are getting. While this will happen naturally as more and more cases are solved using forensic genealogy and DTC databases, it is important to encourage consumer awareness now. While individual consumers have the responsibility to educate themselves, privacy advocacy groups could also consider social media campaigns, or ad campaigns to raise awareness. If someone decides to submit his or her DNA to a DTC provider, the U.S. National Library of Medicine provides a guide for consumers on how to assess a company’s privacy practice.119 It recommends researching what the company does with the DNA sample once analysis is complete, determining who owns the genetic data, who the company will share the data with, whether or not a consumer can “opt out” of data sharing, and whether consumers will be notified in the future if the company changes its privacy policies.120 Something that would go a long way towards reducing ethical concerns would be for every DTC provider with a DNA database to have an active “opt in” option to government searching. This way, consumers would be making an active choice to make their genetic information available for criminal investigations. Officials at FTDNA made it possible for consumers to opt out of familial matching, which prevents their profiles from being searchable by the FBI but simultaneously prevents them from finding possible relatives through DNA testing.121 Companies should make it possible for consumers to protect their genetic data from government investigations while still being able to be found by relatives. In May, GEDmatch revised its policy to an active “opt in,” where consumers had to actively agree to be included in any searches done by government agencies.122 This reduced the number of profiles police could search by 90%, from roughly 1.4 million to 140,000.123 While this

119 GENETICS HOME REFERENCE, How Do Direct-to-Consumer Genetic Testing Companies Protect Their Customer’s Privacy?, U.S. NAT’L LIBRARY OF MED. (Mar. 3, 2020), https://ghr.nlm.nih.gov/primer/dtcgenetictesting/dtcprivacy. 120 Id. 121 Hernandez, supra note 43. 122 Kaiser, supra note 10. 123 Id.

2020 ETHICAL IMPLICATIONS 203 reduction has no doubt disappointed many investigators, it will more fully ensure that consumers know if their DNA is being used in investigations. This is an important step towards the balance between genetic privacy and public safety. Companies need to be better at ensuring the DNA they are testing has been sent in with consent. A requirement of written consent from the specific genetic donor could be a more feasible first step towards regulating the DTC market and a vital component of any proposed legislation. A suggested consent form should:

inform the donor of the purpose and scope of testing; the length of time the sample and results will be retained; the potential corollary uses, if any, for which the donor's sample and results will be used; and identification of third parties that may conduct any testing or analysis of the sample or results. The form shall also include an “opt- out” provision in which the donor may elect to have the sample and results destroyed upon completion of the stated purpose and scope of testing.124

While a written consent form does not guarantee that someone cannot masquerade as the genetic donor and forge the donor’s signature, it provides a legitimate deterrence and is an active step on the part of the DTC provider to more fully ensure privacy and informed consumer consent.

B. DNA Privacy Laws

The only current federal legislation that governs genetic privacy is the Health Insurance Portability and Accountability Act of 1966 (“HIPAA”) and the Genetic Information Nondiscrimination Act of 2008 (“GINA”). However, they are both limited in scope, and neither is applicable to DTC DNA testing.125 About half of the American states have laws that protect genetic privacy, but there is no level of consistency in those laws.126 In most American jurisdictions, the nonconsensual collection of human tissue for DNA analysis purposes is not a crime or

124 Colin McFerrin, DNA, Genetic Material, and a Look at Property Rights: Why You May Be Your Brother's Keeper, 19 TEX. WESLEYAN L. REV. 967, 996 (2013). 125 Id. 126 Wickenheiser, supra note 7, at 120. 204 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II even a civil violation.127 While some states address it on a surface level, Alaska’s law is the most comprehensive. In Alaska, people are prohibited from “collect[ing] a DNA sample from a person, perform[ing] a DNA analysis on a sample, retain[ing] a DNA sample or the results of a DNA analysis, or disclos[ing] the results of a DNA analysis unless the person first obtained the informed and written consent of the person.”128 Alaska’s statute also states that DNA samples and the result of the DNA analysis are the exclusive property of the person sampled or analyzed.129 A suggested change to DNA law is to make DNA theft a separate crime. Currently, the nonconsensual collection and analysis of another person’s DNA is virtually unrestrained by law.130 People shed genetic material on a daily basis in the form of hair, discarded tissues, used cups, and other ways. There is no preventing the loss of personal, genetic material. This becomes a problem when third parties retrieve this discarded genetic material for their own purposes. Police are not the only ones who may be interested in people’s genetic information. There are also concerns about political parties analyzing opposing party candidates’ DNA and professional sports teams analyzing athletes’ DNA; similarly, there are those who are interested in selling celebrity DNA information.131 Under one proposed law, the offense of DNA theft would criminalize the nonconsensual DNA collection and analysis by third parties. Specifically, it would “prohibit (1) knowingly taking or storing another person’s bodily material (2) without consent (3) for the purpose of analyzing or disclosing the genetic information therein”.132 Other proponents of the introduction of some sort of DNA theft law point out that any legislation would need to account for familial relationships and shared genetic information. If legislation fails to take this in to account, “an individual would have no recourse against a family member that intentionally or mistakenly shares ‘that person’s genetic secrets.’”133 Any legislation also needs to consider the inverse—that legislation could go too far and be too stringent, to the point that family members find themselves subject to criminal or civil

127 Joh, supra note 56, at 666. 128 Id. at 687. 129 McFerrin, supra note Error! Bookmark not defined., at 987. 130 Joh, supra note 56, at 666. 131 Id. at 666–67. 132 Id. at 689. 133 McFerrin, supra note Error! Bookmark not defined., at 994.

2020 ETHICAL IMPLICATIONS 205 liability for releasing their own genetic information.134 Because of the inescapable shared nature of genetic information, it would be important for these issues to be thoroughly researched and carefully worded so as to not be too stringent but still be effective. The United Kingdom passed a law in 2006 that recognized DNA theft as a criminal offense.135 The Human Tissue Act defines the nonconsensual taking of another person’s bodily material for genetic analysis as a criminal offense, unless it is for an approved purpose (i.e. law enforcement purposes).136 Here, the absence of the tissue provider’s consent is a central component of the offense.137 If a person is found guilty of DNA theft, that person is subject to a fine, three years in prison, or both.138 While making DNA theft a separate crime may not seem to directly correlate to DTC databases and forensic genealogy, it would implement another guard against people uploading others’ DNA to a DTC without their consent. The United States Federal Government could use the United Kingdom’s Human Tissue Act as a starting model to implement a law that would criminalize DNA theft. Or, states could start implementing a law that, at the very least, addresses DNA theft and makes it a civil violation, even if they do not go so far as to criminalize DNA theft. Additionally, criminalizing DNA theft and the nonconsensual collection and analysis of DNA provides motivation for DTC providers to ensure that the samples submitted to them are done so with legitimate consent. Adopting a DNA theft offense could also help lend some clarity to the appropriate Fourth Amendment characterization of genetic information that people shed. Specifically, “[t]he existence of a DNA theft offense expresses a social norm that genetic information, wherever it is found, retains individual privacy interests that deserve protection from theft.”139 Another suggestion for regulation of DNA privacy, especially in relation to DTC providers, is to treat it similar to criminal justice databases. “A high level of structured policy and protection is placed on use of criminal justice databases, such that this could provide needed framework to genealogical searching rather than the laissez faire approach

134 Id. 135 Human Tissue Act 2004, c. 30 (U.K.), http://legislation.data.gov.uk/ukpga/2004/30/notes/data.pdf. 136 Id. 137 Id. 138 Id. 139 Joh, supra note 56, at 696. 206 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II apparent in the direct to consumer marketplace.”140 Safeguards would include only allowing specific authorized law enforcement individuals to access and use DTC databases, ensuring there are checks and balances for access, and strict use of the data that is accessed.141

C. Case Selection Criteria

Realistically, a strict case selection criterion is the preventative measure that is most likely to be implemented and approved. Currently, DTC databases have only been used to solve major crimes, such as serial killer cases and infamous cold cases. Case selection criteria should be set before the cases begin—that way, law enforcement officers cannot tailor the criteria to whatever case they are working on when they want to justify the use of forensic genealogy. Use of forensic genealogy should be limited to major crimes against a person with a public safety threat. Cases should be vetted to ensure traditional means of investigation have not succeeded. To qualify for genealogical searching, there must also be no match made to a suspect profile in NDIS as well as sufficient DNA for testing to yield an accurate search against public databases.142 The limited application for cases of major crime is supported by public opinion, as evidenced by a survey conducted by bioethicists where 79% of 1,587 individuals polled supported use in major crimes against the person of homicide and rape.143 The support for using forensic genealogy in cases of property crime was only 39%, whereas respondents were 80% in favor of using forensic genealogy in cases of violent crime.144 Given the recent implementation of the interim guidelines on a federal level, this seems like the most probable immediate solution to the ethical debate surrounding the use of forensic genealogy in criminal investigation. One bioethicist from the Baylor College of Medicine in Houston predicts that the federal guidelines will become the national model because “[he] think[s] people are trying to do this right.”145

140 Wickenheiser, supra note 7, at 120. 141 Id. 142 Id. 143 Id. 144 Id. 145 Kaiser, supra note 10.

2020 ETHICAL IMPLICATIONS 207

CONCLUSION

The use of forensic genealogy to solve criminal cases is likely to increase in the coming years, especially given its success in solving cold cases. While its potential for good is impressive, there are also legitimate ethical concerns that need to be addressed. As society sees an increase in the use of forensic genealogy and DTC databases in criminal investigations as well as an increase in the media attention it garners, there will be more discussion regarding ethical implications. Legal scholars say that it is only a matter of time before courts weigh in on the privacy of DNA,146 and I predict that in the next few years, we will see an increase in cases and legislation regarding DTC providers and forensic genealogy.

146 St. John, supra note 17. 208 BUSINESS, ENTREPRENEURSHIP & THE LAW VOL. XIII:II